CN115729166A - A safety interlock system, method and medium for medical heavy ion accelerator - Google Patents

Abstract

The invention relates to a safety interlock system, method and medium for a medical heavy ion accelerator, comprising: each sub-module of the accelerator is used for sending an interlocking equipment fault signal to the safety interlocking module of the accelerator; the accelerator safety interlocking module is used for receiving an interlocking equipment fault signal and sending a beam current allowing signal to the treatment control module, the accelerator control module and the central timing module according to fault absorption; the treatment control module is used for sending a beam selection signal to the accelerator safety interlocking module and receiving a beam permission signal sent by the accelerator safety interlocking module; the accelerator control module is used for receiving the equipment fault signal, the beam allowable signal and the fault shielding signal which are sent by the accelerator safety interlocking module; and the central timing module is used for sending a treatment or debugging mode switching signal to the accelerator safety interlocking module and receiving a beam current allowing signal sent by the accelerator safety interlocking module. The method can monitor the running state of each submodule of the accelerator in real time.

Description

A safety interlock system, method and medium for medical heavy ion accelerator

technical field

The invention relates to a safety interlock system, method and medium for medical heavy ion accelerators, belonging to the technical field of heavy ion accelerators.

Background technique

The medical heavy ion therapy device is currently the largest medical device, with a large scale, many types of equipment, complicated systems, and a large amount of investment. The medical heavy ion therapy device is composed of accelerator subsystem, treatment subsystem and auxiliary system. The accelerator subsystem includes accelerator control system, vacuum system, power supply system, beam diagnosis system, cooling system, injection/extraction system, radiation protection system, high frequency system, etc. The accelerator control system is an important part of the accelerator subsystem. Its main function is to realize the monitoring and control of the accelerator equipment, and to display the operating status and parameters of the equipment in real time. The treatment control system is an important part of the treatment subsystem, and its main function is to use the heavy ion beam provided by the accelerator to treat patients.

The accelerator safety interlock system is a subsystem of the medical heavy ion accelerator control system. The system monitors the operating status of the key equipment of each subsystem of the accelerator in real time, analyzes and processes the monitoring data, and gives feedback to the user of the current status of each area of the accelerator. Device status information, and at the same time provide a signal to the treatment control system whether to allow the application of the beam. At present, there are some deficiencies in the stability, response speed, software and hardware development cycle, reliability and safety of the accelerator safety interlock system. The research and development of an accelerator safety interlock system with better performance is of great significance to the application of medical heavy ion therapy devices. .

At present, there are various types of accelerator safety interlocking systems used in medical heavy ion therapy devices, some of which only use software for data acquisition and logic operations, or use hardware for data acquisition, and transmit the calculation results to the treatment center in the form of software variables through the network. Control system and interlocked equipment side. However, this interlocking system with input and output in the form of software variables has great potential safety hazards, such as network interruption, communication blockage, software failure, etc., which will affect the accuracy, stability and timeliness of the interlocking system.

Contents of the invention

In response to the above problems, the purpose of the present invention is to provide a safety interlock system, method and medium for medical heavy ion accelerators, which have higher stability and reliability, and can monitor the operating status of each sub-module of the accelerator in real time. It can alarm in time when the equipment fails or shuts down.

In order to achieve the above object, the present invention proposes the following technical solutions: a safety interlock system for medical heavy ion accelerators, including: accelerator sub-modules, accelerator safety interlock module, treatment control module, accelerator control module and central timing Module, each sub-module of the accelerator, is used to send the fault signal of the interlocking equipment to the safety interlocking module of the accelerator; and the central timing module to send the beam current permission signal; the treatment control module is used to send the beam current selection signal to the accelerator safety interlock module and receive the beam current permission signal sent by the accelerator safety interlock module; the accelerator control module is used to receive the accelerator The equipment failure signal, beam current permission signal and fault shielding signal sent by the safety interlock module; the central timing module is used to send the treatment or debugging mode switching signal to the accelerator safety interlock module, and receive the beam current permission signal sent by the accelerator safety interlock module Signal.

Further, the accelerator safety interlocking module includes an OPC server and an on-site PLC control station, and the output ends of the OPC server are respectively connected to the servers of the treatment control module, the accelerator control module and the central timing module; the input ends of the OPC server are connected to the output ends of the on-site PLC control station, The input end of the on-site PLC control station is connected with each sub-module of the accelerator.

Further, the output end of the OPC server is connected to the servers of the treatment control module, the accelerator control module and the central timing module through the accelerator LAN; the OPC server and the on-site PLC control station are connected through real-time industrial Ethernet, and each on-site PLC control station is also connected through real-time industrial Ethernet ; The on-site PLC control station is connected to each sub-module of the accelerator through RVVP shielded cables.

Furthermore, the PROFINET RT bus protocol is used for data interaction between the on-site PLC control station and the OPC server, and the on-site PLC control stations are connected through the optical fiber ring network.

Furthermore, the OPC server has the function of a data transfer station. The OPC server publishes all processed or filtered data in the form of OPC UA variables through the protocol conversion module according to the standard industrial OPC UA protocol; the OPC server has a safety interlock module for the accelerator. It has the functions of configuration, configuration, debugging and maintenance, and has an operator control station and an engineer operation and maintenance station.

Further, the on-site PLC control station collects the fault signals of each sub-module of the accelerator in real time, performs logic operations on the collected data of each sub-module of the accelerator, and adds the result of the logic operation to the optical fiber ring network to output the beam current permission signal.

Further, all on-site PLC control stations are powered by an uninterruptible power supply system.

Further, if each sub-module of the accelerator outputs a high level to the on-site PLC control station of the accelerator safety interlock module, it is judged that the corresponding sub-module of the accelerator is faulty; if each sub-module of the accelerator outputs a low level to the on-site PLC of the accelerator safety interlock module The control station judges that the corresponding sub-module of the accelerator is working normally.

The present invention also discloses a safety interlock method for a medical heavy ion accelerator, which is used for any one of the above safety interlock systems for a medical heavy ion accelerator, including the following steps: Lock signal; read the beamline configuration signal issued by the central timing module, and the mode configuration signal issued by the treatment control module; the accelerator safety interlock module judges the status of each sub-module of the accelerator, and if the sub-module fails, it will interlock the central timing module Stop triggering, so that each sub-module of the accelerator stops running, and does not generate a beam current permitting signal; if the sub-module does not fail, generate a beam current permitting signal, and send the beam current permitting signal to the treatment control module; if the treatment control module receives the beam current If the flow permitting signal is received, the patient treatment will be carried out. If a sub-module of the accelerator fails while the patient is being treated, the treatment will be immediately interlocked with the treatment control module to interrupt the treatment.

The present invention also discloses a computer-readable storage medium, on which a computer program is stored, and the computer program is executed by a processor to realize the above-mentioned safety interlocking method for a medical heavy ion accelerator.

Due to the adoption of the above technical scheme, the present invention has the following advantages: 1. The scheme of the present invention can effectively protect the safety of equipment and personal safety, effectively avoid the hidden dangers of radioactive safety caused by misoperation, and greatly reduce The interlocking accuracy, stability and timeliness brought about by blockage and software failure bring great flexibility to equipment debugging and patient treatment. 2. The optical fiber ring network technology adopted in the present invention greatly improves the reliability and security of the local area network of the accelerator safety interlocking system, makes the network always in a redundant mode, and effectively eliminates the hidden danger of network failure caused by the breakage of the optical fiber link. 3. In the present invention, the on-site PLC control station is distributed in each area of the accelerator, so that the real-time operations in the system are run in different remote control stations, realizing the combination of "centralized management and decentralized control", improving the system's parallel processing capability and Real-time response speed greatly reduces system risk and facilitates system expansion and upgrade. 4. In the present invention, the uninterruptible power supply (Uninterruptible Power System, abbreviated as UPS) power supply technology is used to ensure that the computer system continues to work for a period of time after a power failure, so that the user can store important data urgently and close important application programs, so that the user does not suffer from Data loss and equipment hardware and software damage due to power outages ensure the data security and reliability of the accelerator safety interlock system.

Description of drawings

Fig. 1 is a structural schematic diagram of a safety interlock system for a medical heavy ion accelerator in an embodiment of the present invention;

Fig. 2 is a schematic structural diagram of an accelerator safety interlock module in an embodiment of the present invention;

Fig. 3 is a flowchart of a safety interlocking method for a medical heavy ion accelerator in an embodiment of the present invention;

Fig. 4 is an interface diagram for a medical heavy ion accelerator in an embodiment of the present invention.

Detailed ways

In order to enable those skilled in the art to better understand the technical solution of the present invention, the present invention is described in detail through specific examples. However, it should be understood that specific embodiments are provided only for better understanding of the present invention, and they should not be construed as limiting the present invention. In describing the present invention, it should be understood that the terms used are for the purpose of description only, and should not be understood as indicating or implying relative importance.

In order to solve the great potential safety hazards in the input-output interlocking system existing in the prior art, such as network interruption, communication blockage, software failure, etc., which will affect the accuracy, stability and timeliness of the interlocking system, this paper The invention proposes a safety interlock system, method and medium for medical heavy ion accelerators, which has higher stability and reliability, and can monitor the operating status of each sub-module of the accelerator in real time, and when the equipment fails or shuts down It can give an alarm in time, give the user feedback on the current operating status information of the accelerator equipment, and interlock the accelerator synchronous timing system (CTS), and at the same time provide a signal to the treatment control system (TCS) whether to allow the application of the beam, that is, the beam is allowed Signals (Beampermit Signals), when the accelerator equipment fails, TCS cannot apply for beam flow, so as to ensure the accelerator equipment and personal safety. The equipment of each system needs timely, efficient and accurate communication. The solutions of the present invention will be described in detail below through embodiments in conjunction with the accompanying drawings.

Embodiment one

The invention discloses a safety interlock system for a medical heavy ion accelerator, as shown in Figure 1, comprising: each sub-module of the accelerator, an accelerator safety interlock module, a treatment control module, an accelerator control module and a central timing module, the accelerator Each sub-module is used to send the fault signal of the interlocking equipment to the accelerator safety interlock module; The module sends the beam current permission signal; the treatment control module is used to send the beam current selection signal to the accelerator safety interlock module, and receives the beam current permission signal sent by the accelerator safety interlock module; the accelerator control module is used to receive the accelerator safety interlock signal The equipment fault signal, beam current permission signal and fault shielding signal sent by the module; the central timing module is used to send the treatment or debugging mode switching signal to the accelerator safety interlock module, and receive the beam current permission signal sent by the accelerator safety interlock module.

The sub-modules of the accelerator in this embodiment include: a vacuum system, a power supply system, a beam diagnosis system, a cooling system, an injection/extraction system, a radiation protection system and a high frequency system.

The accelerator safety interlocking module includes an OPC server (i.e. upper computer), a field PLC control station (i.e. lower computer) and a communication network. for Process Control), OLE for Process Control, is an industry standard. The full name of OLE is Object Linking and Embedding, that is, object connection and embedding.

As shown in Figure 2, the input end of the OPC server is connected to the output end of the on-site PLC control station, and the input end of the on-site PLC control station is connected to each sub-module of the accelerator. The output terminal of the OPC server is connected to the servers of the treatment control module (TCS), accelerator control module (CACS) and central timing module (CTS) through the accelerator LAN; the OPC server and the on-site PLC control station are connected through real-time industrial Ethernet for data and information exchange . Each on-site PLC control station is also connected through real-time industrial Ethernet; the on-site PLC control station and each sub-module of the accelerator are connected through RVVP shielded cables, which improves the anti-interference performance of data transmission in the field strong magnetic field environment and ensures the stability of transmitted data , authenticity and reliability. The accelerator safety interlock module is an independent system with its own complete structure and adopts C/S architecture. The OPC server provides a graphical operation interface for professional operators, and gives users feedback on the current equipment status information of each area of the accelerator. It also has functions such as personnel management, data storage, data analysis, and report output. The new generation of PROFINET RT bus protocol based on industrial Ethernet technology is used for data interaction between the on-site PLC control station and the OPC server. The response time is less than 10ms, and it has the characteristics of high-speed data transmission and real-time response. Each on-site PLC control station is connected through an optical fiber ring network to realize data interaction between sub-stations and between sub-stations and the host computer. In order to ensure the safety, reliability and real-time performance of data transmission in the accelerator safety interlock system, the accelerator safety interlock system uses a real-time industrial Ethernet-based optical fiber ring network to realize high-speed data transmission between on-site PLC control stations. The optical fiber ring network is mainly composed of on-site PLC control stations connected end-to-end with 100M multi-mode optical fibers. The optical fiber ring network keeps the network in redundant mode at all times, which effectively prevents the hidden danger of affecting the overall network communication due to a failure of one optical fiber link, and improves the security and reliability of the system.

The man-machine interface, real-time database, data storage, protocol conversion and fault alarm generation of the accelerator safety interlocking system all run on the OPC server of the accelerator safety interlocking system.

The OPC server has the function of a data transfer station. Through the protocol conversion module, the OPC server publishes all processed or filtered data in the form of OPC UA variables according to the standard industrial OPC UA protocol; among them, all processed or filtered data, including : Accelerator subsystem equipment fault signal, accelerator current operating status signal of each area equipment, accelerator treatment or debugging mode signal, beam current permission signal, equipment shielding signal and fault alarm signal.

The OPC server has the functions of configuration, configuration, debugging and maintenance of the accelerator safety interlock module, and has an operator control station and an engineer operation and maintenance station.

The on-site PLC control station is composed of Siemens 1500 series PLC hardware, which collects the fault signals of each sub-module of the accelerator in real time, performs logic operations on the collected data of each sub-module of the accelerator, and adds the result of the logic operation to the optical fiber ring network, and outputs the beam Stream enable signal. The on-site PLC control station is distributed in the accelerator control cabinet along the beamline and inside the accelerator power supply area control cabinet.

All on-site PLC control stations are powered by an Uninterruptible Power System (UPS) power supply system, which ensures the power supply of the accelerator safety interlock system and equipment safety.

If each sub-module of the accelerator outputs a high level to the on-site PLC control station of the accelerator safety interlock module, it is judged that the corresponding sub-module of the accelerator is faulty; if each sub-module of the accelerator outputs a low level to the on-site PLC control station of the accelerator safety interlock module , it is judged that the corresponding sub-module of the accelerator is working normally.

The subsystems of the accelerator include: vacuum system, power supply system, beam diagnosis system, cooling system, injection/extraction system, radiation protection system, and high frequency system.

Vacuum system equipment includes: pneumatic valve, quick-closing valve, dry mechanical pump, vacuum gauge; when the valve or dry mechanical pump is closed or fails, the on-site PLC control station collects a high level, indicating that the vacuum system is faulty, and the on-site PLC control station A low level is collected, indicating that the vacuum system is normal. When the vacuum degree of the accelerator collected by the vacuum gauge exceeds the set threshold, the valve in the corresponding area is triggered to be interlocked and closed in time to prevent equipment damage caused by the accelerator vacuum pipeline breaking vacuum.

The power supply system equipment includes: DC power supply, pulse power supply, and high-voltage power supply; when the power supply is turned off or fails, the on-site PLC control station collects a high level, indicating that the power system is faulty, and the on-site PLC control station collects a low level, indicating that the power supply system is normal .

Beam diagnostic system equipment includes: Faraday cylinder, monofilament, and multifilament; when the beam diagnostic system equipment fails or the equipment motor components do not reach the specified limit, the on-site PLC control station collects a high level, indicating that the beam diagnostic system Fault, the on-site PLC control station collects a low level, indicating that the beam current diagnosis system is normal.

The cooling system equipment includes: cooling system PLC; the cooling system PLC collects the on-site accelerator cooling water temperature, water quality, and water pressure. When one of the water temperature, water quality, and water pressure exceeds the set threshold, the cooling system PLC outputs a high level to the accelerator safety connection. The on-site PLC control station of the locking system indicates that the cooling system is faulty; when the water temperature, water quality, and water pressure do not exceed the set thresholds, the cooling system PLC outputs a low level to the on-site PLC control station of the accelerator safety interlock system, indicating that the cooling system is normal.

Injection/extraction system equipment includes: ion source and rotary valve, ion source and rotary vacuum gauge, ion source microwave machine, ion source and rotary high-voltage power supply, rotary water flow relay, rotary transmitter, and rotary low-level equipment. When the valve is closed, or the vacuum collected by the vacuum gauge exceeds the set threshold, or the ion source microwave machine fails, or the ion source and the gyro high-voltage power supply fail, or the gyro water flow relay operates, or the gyro transmitter fails, or the gyro low-level equipment When a fault occurs, the on-site PLC control station collects a high level, indicating that the injection/extraction system is faulty, and the on-site PLC control station collects a low level, indicating that the injection/extraction system is normal.

The ion source and the rotary vacuum gauge collect the vacuum degree inside the injection/extraction vacuum pipeline. When the vacuum degree exceeds the set threshold, the vacuum gauge outputs a high level to the on-site PLC control station of the accelerator safety interlock system. After the on-site PLC control station passes a logical judgment , Output interlocking signal to close the ion source and swing high-voltage power supply, swing transmitter, swing low-level equipment.

The radiation protection system equipment includes: radiation protection PLC; when the beam blocking equipment of the radiation protection system fails or is closed, or the radiation protection safety door of the accelerator area is opened, or the accelerator area has not been cleared and confirmed, or the accelerator operator has not made the final confirmation, the radiation protection The system PLC outputs a high level to the on-site PLC control station of the accelerator safety interlock system, indicating that the radiation protection system is faulty; the radiation protection system PLC outputs a low level to the on-site PLC control station of the accelerator safety interlock system, indicating that the radiation protection system is normal.

The high-frequency system equipment includes: synchronous ring high-frequency low-level, gyratory transmitter, and gyratory low-level equipment; The low level collected by the control station indicates that the high frequency system is normal.

TCS equipment includes: treatment control system interlock board; the accelerator safety interlock system outputs a beam current permission signal in the form of a hardware dry contact to the treatment control system interlock board, and the treatment control system interlock board detects a high level, It indicates that the accelerator is currently normal and has the conditions to provide beam current, and patient treatment can be performed; the interlock board of the treatment control system detects a low level, indicating that the accelerator is currently faulty and does not have the conditions to provide beam current, and patient treatment cannot be performed.

Embodiment two

Based on the same inventive concept, this embodiment discloses a safety interlock method for medical heavy ion accelerators, which is used for any of the above safety interlock systems for medical heavy ion accelerators, as shown in Figure 3, Include the following steps:

S1 reads the interlocking signals of each sub-module of the accelerator;

S2 reads the beamline configuration signal issued by the central timing module and the mode configuration signal issued by the treatment control module;

The S3 accelerator safety interlock module judges the status of each sub-module of the accelerator. If a sub-module fails, the interlock central timing module stops triggering, so that each sub-module of the accelerator stops running, and does not generate a beam current permission signal;

S4 If the sub-module does not fail, generate a beam current permission signal, and send the beam current permission signal to the treatment control module;

S5 If the treatment control module receives the beam current permission signal, the patient treatment will be carried out. If a sub-module of the accelerator fails while the patient treatment is in progress, the treatment control module will be interlocked immediately to interrupt the treatment.

Embodiment Three

Based on the same inventive concept, this embodiment discloses a computer-readable storage medium, on which a computer program is stored, and the computer program is executed by a processor to realize the above-mentioned safety connection for a medical heavy ion accelerator. lock method.

The treatment control module, the accelerator control module and the central timing module independently access the OPC server of the accelerator safety interlock system through the accelerator LAN through the OPC UA protocol.

The accelerator control module operates the entire safety interlock system. The schematic diagram of the client interface of the accelerator safety interlock is shown in Figure 4. The client interface of the accelerator safety interlock system displays the current operating status of the accelerator area in real time. When one or more devices When there is a fault or stops running, the interface of the corresponding area will give a flashing alarm, so that the user can locate the faulty equipment and deal with it in time.

The OPC server includes the accelerator safety interlock system server interface, alarm/historical data archiving and query components. The local database developed based on SOL Server 2008 and the OPCServer Station designed based on Siemens' SIMATICNET run on the OPC server of the accelerator safety interlocking system, and provide a standard common interface for external database design and development through ODBC.

The server/client interface of the accelerator safety interlocking system is equipped with a fault shielding module, that is, the user can ignore the fault information of the interlocking device, and send the shielding information to the lower computer PLC program for the lower computer PLC to perform corresponding operations. logic operations.

OPC Server Station software is designed based on Siemens SIMATICNET software. By configuring PCStation, configure SIMATICNET as an OPC Server virtual station to provide device drivers and APPlication interfaces. OPCServer software supports communication protocols such as S7 protocol, FDL protocol, PG/OP, etc., and provides access authorization based on these protocols. Different authorizations support different protocols and connection numbers. The OPC Server of the accelerator safety interlocking system uses the S7 protocol to communicate with the on-site PLC control station to realize access to PLC data.

The PLC program of the lower computer is designed and developed based on the TIA software of Siemens Corporation, and runs in the on-site PLC control station. The program accepts the control commands issued by the upper computer, drives the PLC remote data acquisition module to collect data, and performs logic operations and output operations on the collected data. Results and Beampermit Signals.

The CTS software runs on the CTS server and provides a unified time reference for the accelerator, so that the accelerator device can run according to the set timing. When the accelerator is fault-free and the CTS is triggered, the accelerator will output the expected beam current, and after the CTS stops triggering, the accelerator will stop the beam output.

When the accelerator safety interlock system judges that the accelerator equipment is faulty, the interlock CTS will stop triggering, so that the accelerator equipment will stop running, so as to avoid personal safety hazards caused by accelerator equipment damage and false exposure. The accelerator safety interlock system provides a treatment/debugging signal to the CTS software. When the CTS software is switched to the debugging mode, the control authority of the beam is delivered to the accelerator operation and maintenance personnel. At this time, the daily performance debugging of the beam quality can be carried out; when switching to In the treatment mode, the control authority of the beam is delivered to the treatment terminal doctor for patient treatment. At this time, the accelerator safety interlock system client interface and the accelerator safety interlock system interface will be locked, and the interface can only display data graphically. No manual operation can be performed, and the CTS switches to commissioning mode after the treatment is finished.

The TCS software runs on the TCS server to monitor the treatment terminal equipment and accelerator safety interlock system, etc.

The accelerator safety interlock system outputs a beam current permission signal in the form of a hardware dry contact to the treatment control system interlock board, and the TCS software monitors the beam current permission signal. When the signal is logic True, it indicates that the accelerator is normal and capable of providing beam current. If the conditions are met, patient treatment can be carried out, otherwise, it indicates that the accelerator is faulty, and the conditions for providing beam current are not available, and patient treatment cannot be carried out. When the patient is being treated, the beam current permission signal changes from high level to low level, and the TCS will be interlocked immediately to interrupt the treatment. After the accelerator is repaired and faulty, the patient treatment will be carried out according to the treatment plan again.

Traditional accelerators only have two modes of debugging and treatment, but this patent refines the treatment mode. Users can switch to the required beamline for treatment according to current needs, and shield unnecessary beamlines to prevent false triggering of other accelerators. Harnessing the wires may cause a safety accident. In this embodiment, the accelerator safety interlock system also provides five beamline selection signals to the TCS software. When TCS performs patient treatment, one of the high-energy transmission beamlines is selected to transmit particles according to the treatment plan. At this time, the treatment control system needs to switch beamlines. Select the signal to the corresponding high-energy transmission beamline. However, the accelerator safety interlock system stipulates that the treatment control system can only select one beamline for beam extraction at the same time. Therefore, when the treatment control system switches the beamline selection signal to one beamline, the accelerator safety interlock system will switch the beamline selection signal of the other four beamlines Beampermit Signals are forced to be disallowed, which effectively avoids radioactive safety hazards caused by misoperation.

The PLC program of the lower computer reads the interlocking signals of each subsystem of the accelerator in real time, and according to the mode information selected by the CTS, the beamline information selected by the TCS, and the shielded signal configured on the server/client interface of the accelerator safety interlocking system, each Logically judge the overall operation of each region, and finally output whether each region of the accelerator meets the beam supply signal, that is, the beam current permission signal (Beampermit Signals). This signal is output to the therapy control system as a dry contact.

Those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowcharts and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to the above embodiments, those of ordinary skill in the art should understand that: the present invention can still be Any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention shall fall within the protection scope of the claims of the present invention. The above content is only the specific implementation of the application, but the scope of protection of the application is not limited thereto. Any person familiar with the technical field can easily think of changes or replacements within the technical scope disclosed in the application, and should cover Within the protection scope of this application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims (10)

1. A safety interlock system for a medical heavy ion accelerator, characterized in that it comprises: each submodule of the accelerator, an accelerator safety interlock module, a treatment control module, an accelerator control module and a central timing module, Each sub-module of the accelerator is used to send an interlocking device failure signal to the accelerator safety interlocking module; The accelerator safety interlock module is used to receive the fault signal of the interlock device, and send the beam current permission signal to the treatment control module, the accelerator control module and the central timing module according to the fault absorption; The treatment control module is configured to send a beam selection signal to the accelerator safety interlock module, and receive a beam permission signal sent by the accelerator safety interlock module; The accelerator control module is configured to receive the equipment fault signal, beam current permission signal and fault shielding signal sent by the accelerator safety interlock module; The central timing module is used to send a treatment or debugging mode switching signal to the accelerator safety interlock module, and receive a beam current permission signal sent by the accelerator safety interlock module. 2. the safety interlock system that is used for medical heavy ion accelerator as claimed in claim 1, is characterized in that, described accelerator safety interlock module comprises OPC server and on-the-spot PLC control station, and described OPC server output end connects respectively The server of the treatment control module, the accelerator control module and the central timing module; the input end of the OPC server is connected with the output end of the on-site PLC control station, and the input end of the on-site PLC control station is connected with each submodule of the accelerator. 3. the safety interlocking system that is used for medical heavy ion accelerator as claimed in claim 2, is characterized in that, described OPC server output end is connected the server of described treatment control module, accelerator control module and central timing module by accelerator local area network The OPC server and the on-site PLC control station are connected through real-time industrial Ethernet, and each of the on-site PLC control stations is also connected through real-time industrial Ethernet; the on-site PLC control station and each sub-module of the accelerator are connected through RVVP shielded cables. 4. the safety interlocking system that is used for medical heavy ion accelerator as claimed in claim 3, is characterized in that, adopts PROFINET RT bus agreement to carry out data interaction between described field PLC control station and OPC server, each described field PLC The control stations are connected through the optical fiber ring network. 5. the safety interlocking system that is used for medical heavy ion accelerator as claimed in claim 2, it is characterized in that, described OPC server has the function of data transfer station, and described OPC server passes protocol conversion module, according to standard industry OPC UA The protocol releases all processed or filtered data in the form of OPC UA variables; the OPC server has the functions of configuration, configuration, debugging and maintenance of the accelerator safety interlock module, and has operator control stations and engineer operation maintenance station. 6. the safety interlocking system that is used for medical heavy ion accelerator as claimed in claim 3, it is characterized in that, described on-site PLC control station collects the fault signal of each submodule of accelerator in real time, to the fault signal of each submodule of the acquisition accelerator of collecting Logic operation is performed on the data, and the result of the logic operation is added to the optical fiber ring network, and a beam flow permission signal is output. 7. The safety interlock system for a medical heavy ion accelerator according to any one of claims 1-6, wherein all said on-site PLC control stations are powered by an uninterruptible power supply system. 8. The safety interlock system for medical heavy ion accelerators as claimed in any one of claims 3-6, wherein if each sub-module of the accelerator outputs a high level to the on-site PLC of the accelerator safety interlock module The control station judges that the corresponding submodule of the accelerator is faulty; if each submodule of the accelerator outputs a low level to the on-site PLC control station of the accelerator safety interlock module, it judges that the corresponding submodule of the accelerator is working normally. 9. A safety interlock method for a medical heavy ion accelerator, characterized in that, for the safety interlock system for a medical heavy ion accelerator as claimed in any one of claims 1-8, comprising the following steps: Read the interlock signal of each sub-module of the accelerator; Read the beamline configuration signal issued by the central timing module and the mode configuration signal issued by the treatment control module; The accelerator safety interlock module judges the status of each sub-module of the accelerator. If a sub-module fails, the interlock central timing module stops triggering, so that each sub-module of the accelerator stops running, and does not generate a beam current permission signal; If the sub-module does not fail, generate a beam current permission signal, and send the beam current permission signal to the treatment control module; If the treatment control module receives the beam current permission signal, the patient treatment will be carried out; if a certain sub-module of the accelerator fails while the patient treatment is in progress, the treatment control module will be interlocked immediately to interrupt the treatment. 10. A computer-readable storage medium, characterized in that, a computer program is stored on the computer-readable storage medium, and the computer program is executed by a processor to realize the medical heavy ion accelerator as claimed in claim 9 safety interlock method.

Images